Nuix Ltd. · ASX:NXL
Nuix — Technical Presentation (March 2023)
34 slides from Nuix's technical presentation, March 2023
Slide 1: It's What's Inside That Counts
It’s What’s Inside That Counts Transforming Investigations to Detect and Prevent Insider Threat
Slide 2: Speakers and agenda
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Intro Speakers Armando Nardo Agenda Forensic Technology | Director – Digital Forensics • Challenges Contact Information • Overview of Nuix Adaptive Security +44 20 7303 5791 [email protected] • Walk
Slide 3: Challenges
Challenges ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 3
Slide 4: Challenges
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Challenges Increase from 5.7% - 43.1% of UK Zoom usage increased from 36k – workforce WFH in 2020 1.6million daily users Sensitive data is increasing Capture Lack of technical investigative ability digi
Slide 5: Is remote working here to stay?
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Is remote working here to stay? After lockdown 61% of desk-based workers would prefer to work from home more often Research was carried out by Ipsos MORI on behalf of Deloitte LLP. It screened a nationa
Slide 6: Using technology to address some of our challenges
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Using technology to address some of our challenges Enhance your investigative agility by combining monitoring with advanced triage in one unified platform. Drive confidence and reduce effort. Use endpoi
Slide 7: Investigative agility and confidence
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Investigative agility Full Disk Image End user impact Targeted Collection In Threat Level Confidence Streamed Events Forwarded Events Alert Related Events Effort Investigator time, processing/storage, n
Slide 8: Event-based detection and triage
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Event-based detection and triage User Behaviour Context supports action and/or offers insight Uses snipping tool, with a sensitive database open, and a thumb drive Create plugged in, after hours event U
Slide 9: What is an event?
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats What is an event? Process Parent Window Key Data Title Action CMD line Keystroke Process PID User Exec User Path Serial Remote Filename IP Volume Action Ltr Remote Media Action Action File path Port Net
Slide 10: Product Overview
Product Overview ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 10
Slide 11: Product Overview – Nuix Adaptive Security
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Product Overview – Nuix Adaptive Security • Bespoke rule creating process to mould to your business needs and environments. • Lightweight agent deployed on the network stores events and sends alerts bac
Slide 12: Nuix Adaptive Security
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Nuix Adaptive Security Events Process Start Network Connection Removable Media File Write Registry Write Document Printed DLL Loaded User Logon Filter Engine State Rule Set Database Alert Block Killproc
Slide 13: Scenario 1 - Data Theft and Disclosure
Scenario 1 - Data Theft and Disclosure ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 13
Slide 14: Scenario – Data Theft and Disclosure
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 1 – Data Theft and Disclosure Sell sensitive research to a competitor • Acquires report • Pastes some of the data into a chat window • Copies to removable media • Uploads to a file sharing serv
Slide 15: Scenario – Data Theft and Disclosure
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 1 – Data Theft and Disclosure ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 15
Slide 16: Scenario – Data Theft and Disclosure
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 1 – Data Theft and Disclosure Detection of file writes/manipulations, renames and deletions ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insid
Slide 17: Scenario – Data Theft and Disclosure
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 1 – Data Theft and Disclosure Evidence of files being written to local DropBox folder ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Thr
Slide 18: Scenario – Data Theft and Disclosure
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 1 – Data Theft and Disclosure Detection of print jobs originating from endpoint ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 18
Slide 19: Scenario – Data Theft and Disclosure
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 1 – Data Theft and Disclosure Confidential information being shared using external communication channels ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and
Slide 20: Scenario – Data Theft and Disclosure
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 1 – Data Theft and Disclosure Keylogs identifying keywords being typed and destination window ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Ins
Slide 21: Scenario – Data Theft and Disclosure
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 1 – Data Theft and Disclosure Evidence of a file being attached to an email ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 21
Slide 22: Scenario 2 - Fraudulent Transaction
Scenario 2 - Fraudulent Transaction ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 22
Slide 23: Scenario – Fraudulent Transaction
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 2 – Fraudulent Transaction Falsify a purchase order Prepare • Research target company • Set up secure communications • Get tools to clean up evidence Execute • Copy template to local system • F
Slide 24: Scenario – Fraudulent Transaction
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 2 – Fraudulent Transaction ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 24
Slide 25: Scenario – Fraudulent Transaction
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 2 – Fraudulent Transaction Screenshot 1 showing a blank signature box ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 25
Slide 26: Scenario – Fraudulent Transaction
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 2 – Fraudulent Transaction Screenshot 2 showing a filled in signature box ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 26
Slide 27: Scenario – Fraudulent Transaction
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 2 – Fraudulent Transaction Evidence of mass file deletion ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 27
Slide 28: Scenario – Fraudulent Transaction
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 2 – Fraudulent Transaction URL events show web pages visited ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 28
Slide 29: Scenario – Fraudulent Transaction
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Scenario 2 – Fraudulent Transaction Keylogs identifying keywords being typed and destination window ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Inside
Slide 30: Summary and questions
Summary and questions ©2021 Deloitte LLP - Private and Confidential Transforming Investigations to Detect and Prevent Insider Threat 30
Slide 31: Summary and questions
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Summary and questions Live preview a computer Capture document activity See what the user sees remotely File writes, document Capture screenshots of Collect targeted data in manipulations and key activi
Slide 32: Summary and questions
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Summary and questions With this approach and solution, you benefit from: •Quickly identify anomalous behaviour through evidence such as keypresses, files printed and screenshots, that cover user behavio
Slide 33: Questions?
It’s what’s inside that counts: transforming investigations to detect and prevent insider threats Questions? Speakers Armando Nardo Hoke Smith Forensic Technology | Director – Digital Forensics Nuix | VP, Cybersecurity Contact Information Contact Information +44 20 7303 5791 +1 571 446 2165 anardo@d
Slide 34: Deloitte publication notice
This publication has been written in general terms and we recommend that you obtain professional advice before acting or refraining from action on any of the contents of this publication. Deloitte LLP accepts no liability for any loss occasioned to any person acting or refraining from action as a re